The Microsoft Exchange Information Store service repeatedly quits in Exchange 2000 Server and in Exchange Server 2003

On your Microsoft Exchange 2000 Server or on your Microsoft Exchange Server 2003 computer, the Microsoft Exchange Information Store service may quit unexpectedly or may stop responding. Additionally, you may experience all the following symptoms:

• If you are running Exchange in a clustered environment, the information store may unexpectedly fail over to another cluster node. In this scenario, the following event appears in the application log in Event Viewer:

  Event Type: Error
  Event Source: Service Control Manager
  Event Category: None
  Event ID: 7031
  Date: date
  Time: time
  User: N/A
  Computer: computername
  Description: The Microsoft Exchange Information Store service terminated unexpectedly. It has done this number time(s). The following corrective action will be taken in 0 milliseconds: No action.

  Additionally, the following information may appear in the cluster log file:

  0000096c.00000e9c::2004/05/02-01:33:04.463 Microsoft Exchange Information Store 
  <Exchange Information Store Instance - (CLUST02EVS1)>: [EXRES]EcStoreIsAlive RPC 
  exception occurred in call to EcAdminStoreGetVMStatus() with status code 1753 
  (0x6d9)
  

• If you restart the Microsoft Exchange Information Store service, the service runs successfully but then quits again at a random interval.
• If you disable your antivirus program, the Microsoft Exchange Information Store service no longer quits unexpectedly.

This issue may occur when your antivirus program scans e-mail messages that contain LHarc archives.

The LHa algorithm is used to pack and unpack LHarc archive files. Certain e-mail antivirus scanning packages implement the LHa algorithm and run it automatically when they scan e-mail messages that contain attached files. However, the typical implementation of LHa that certain antivirus programs use in their code has memory corruption issues. Because of this, a malicious user can cause certain antivirus packages to crash when they scan certain e-mail attachments. When this issue occurs, the Microsoft Exchange Information Store service quits or stops responding.

To resolve this issue, contact your antivirus program vendor for a possible update to your antivirus program. For information about your hardware manufacturer, visit the following Web site: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

To work around this issue, configure your antivirus program to block .lha message attachments.

For additional information, click the following article number to view the article in the Microsoft Knowledge Base: